A penetration tester is conducting a test after hours and notices a critical system was taken down. Which of the following contacts should be notified first?

The secondary contact is typically notified if the primary contact is unavailable, not as the first point of notification.

While the incident is an emergency, "Emergency" is not typically a designated role but rather a classification of the situation. The contact type would still be primary or secondary, not "emergency".

The technical contact might be involved in resolving the issue, but the initial notification of a critical incident should go to the primary contact responsible for overseeing the engagement.

The primary contact, as outlined in the rules of engagement or contract, is the designated first point of contact for any significant issues or incidents arising during a penetration test, including an accidental critical system shutdown. This ensures proper communication and incident handling protocols are followed.